Malicious Code Injection in async-virtualize-private-link-view Package
Summary
MAL-2025-185631: Malicious code in async-virtualize-private-link-view (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The async-virtualize-private-link-view package is part of the npm ecosystem, often utilized for virtualizing asynchronous operations in web applications. However, it has been identified as part of a malicious campaign that floods the npm registry with harmful packages designed to inflate developer reputation scores through automated publishing scripts.
Vulnerability Detail
This vulnerability originates from the package being associated with a token reward campaign that employs malicious scripts to modify the package.json file. The scripts remove private flags, alter version numbers, and generate random package names, leading to pollution of the npm registry. This can result in compromised application integrity, as developers may unknowingly incorporate these malicious packages into their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall async-virtualize-private-link-viewIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your project does not include the async-virtualize-private-link-view package. Regularly audit your dependencies using tools like npm audit to identify and remove any malicious packages.
Conclusion
The async-virtualize-private-link-view package has been identified as a vector for malicious code injection, posing significant risks to developers and their applications. It is crucial to remove this package and monitor your dependencies to maintain application security.
See every vulnerability recorded for async-virtualize-private-link-view →
FAQ
It is an npm package used for virtualizing asynchronous operations, but it has been compromised with malicious code.
You can use Vulert, which monitors your package-lock.json for vulnerabilities. Visit Vulert Scanner to check your application without signing up.
Using this package can lead to the inclusion of malicious code in your application, compromising its security and integrity.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in real-time.
Uninstall the package immediately and check your project for any other compromised dependencies.
